Knowledge Base

------------------------------------------------------------------------------
Overview
------------------------------------------------------------------------------

The basic idea is that chroot "changes the root (/)" for a user. In the case of ftp, the new root is the user's home directory. What this means is that when the user is logged in via ftp, the client sees /home/username as / and interprets everything from there. This means that anything outside /home/username is completely inaccessible to the user. If an app is needed, it must be added to the user's home directory as it would to a regular QNX installation (usually in /bin, which translates to /home/username/bin in the ftp chroot jail). The following is an example of how to add ls to a chroot ftp jail.

------------------------------------------------------------------------------
Create a new user/group
------------------------------------------------------------------------------

1.Username: ftpguest
2. Home directory: /home/ftpguest
3. Group: [ftp group]

For information on Managing User Accounts under QNX/Neutrino:
6.5.0: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=/com.qnx.doc.neutrino_user_guide/accounts.html
6.4.1: http://www.qnx.com/developers/docs/6.4.1/neutrino/user_guide/accounts.html
6.3.0 SP3: http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/user_guide/accounts.html
4.25: http://www.qnx.com/developers/docs/qnx_4.25_docs/qnx4/user_guide/accounts.html

------------------------------------------------------------------------------
Make sure ftp will work
------------------------------------------------------------------------------

1. Make sure that the file /etc/ftpusers exists that that it either has * (everyone) or the ftp user(s) listed.

For more information on this:
6.5.0: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=/com.qnx.doc.neutrino_utilities/f/ftpusers.html
6.4.1: http://www.qnx.com/developers/docs/6.4.1/neutrino/utilities/f/ftpusers.html
6.3.0 SP3; http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/utilities/f/ftpusers.html

------------------------------------------------------------------------------
Create the chroot jail
------------------------------------------------------------------------------

1. Add the user to /etc/ftpchroot
-----a. Simply add the username on a line by itself

For more information:
6.5.0: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=/com.qnx.doc.neutrino_utilities/f/ftpchroot.html
6.4.1: http://www.qnx.com/developers/docs/6.4.1/neutrino/utilities/f/ftpchroot.html
6.3.0 SP3: http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/utilities/f/ftpchroot.html

------------------------------------------------------------------------------
Find out what we need for the app we want to add to the user's chroot jail
------------------------------------------------------------------------------

1. run objdump on the app, like this:
-----a. "C:\QNX650\host\win32\x86\usr\bin\ntox86-objdump.exe" -x "C:\QNX650\target\qnx6\x86\bin\ls" | grep "NEEDED"
-----b. The location of objdump and ls might be different, depending on the Momentics install location
-----c. Make sure to pick the correct binary to run against, in this case we used the x86 version of ls but an arm processor would have required the arm version...
2. The output of objdump will be the libs needed to run the program.

Example - ls

D:\>ntox86-objdump.exe -x C:\QNX650\target\qnx6\x86\bin\ls | grep NEEDED
NEEDED libc.so.3

In this case, we can see that we'll need libc.so.3. Knowing we're running on an x86 platform, we can find libc.so.3 at: C:\QNX650\target\qnx6\x86\lib\libc.so.3 (path may vary depending on Momentics install)

------------------------------------------------------------------------------
Setup the home directory for the app we want to use
------------------------------------------------------------------------------

1. /home/ftpguest/bin
2. /home/ftpguest/usr/
3. /home/ftpguest/usr/lib

Copy over the binary and library. In the case of ls, our example, we only need one file. Here's where it gets a bit tricky, though. The file needed is libc.so.3 but the file that will be looked for ldqnx.so.2, which is located in /usr/lib on a QNX target and is actually just a link to /proc/boot/libc.so.3. This is also the case for any other apps so if libc.so.3 is needed, it will need to be renamed.

1. Copy C:\QNX650\target\qnx6\x86\lib\libc.so.3 into the newly created home folder under /home/ftpguest/usr/lib
2. Rename the file from libc.so.3 to ldqnx.so.2

NOTE: This guide assumes 6.5 or later, for 6.4 and lower versions, libc.so.2 might be specified as needed by objdump. This is still renamed to ldqnx.so.2, it's simply an older version of libc.

For more information about finding needed libraries:
6.5.0: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=/com.qnx.doc.neutrino_building/config.html
6.4.1: http://www.qnx.com/developers/docs/6.4.1/neutrino/building/config.html
6.3.0 SP3: http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/building/config.html

------------------------------------------------------------------------------
Change the permissions
------------------------------------------------------------------------------

1. chown -R ftpguest /home/ftpguest
2. chgrp -R [ftp group] /home/ftpguest
-----a. I actually set the group to root which means only a root user can change the programs or libraries (or the owner). The only thing to watch for here is that the group has to be one that the admin user has access to (if the admin user isn't root).

For more information on file permissions:
6.5.0: http://www.qnx.com/developers/docs/6.5.0/index.jsp?topic=/com.qnx.doc.neutrino_user_guide/files.html
6.4.1: http://www.qnx.com/developers/docs/6.4.1/neutrino/user_guide/files.html
6.3.0 SP3: http://www.qnx.com/developers/docs/6.3.0SP3/neutrino/user_guide/files.html
4.25: http://www.qnx.com/developers/docs/qnx_4.25_docs/qnx4/user_guide/accounts.html#FILEPERM

That's it, we've created a user and a jail for them. We then added ls and the library it needs, making sure to put them in the correct locations. This example will work out of the box but it would be a good idea to further delve into permissions for the files and directories, although that isn't strictly necessary. Any Unix file permission tutorial will suffice for that.